Repository navigation
[SCF-2415] [Part 2] Remove release-it and release-it-lerna-changelog - #7
Open
Gaurav0 wants to merge 1 commit into
Conversation
This was referenced Oct 28, 2026
Open
Releases in this fork are hand-made "bump version" commits; release-it was never run. Dropping it (and its changelog config, script and RELEASE.md instructions) removes vm2, ip, ip-address, tar 6, parse-url, parse-path, http-cache-semantics 4, form-data 4.0.0 and semver 7.3.5 from the tree. Three of those have advisories with no fixed release. Also deletes config/release.js, the leftover ember-cli-release config (that addon was removed in b25a1b4 and the gulp tasks it calls no longer exist). Audit: critical 50 -> 15, high 114 -> 85. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gaurav0
force-pushed
the
gaurav/chore/SCF-2415-part-2-remove-release-it
branch
from
October 28, 2026 23:53
13d5652 to
6a3b9ee
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the
release-itandrelease-it-lerna-changelogtooling, along withconfig/release.jsand the matchingRELEASE.mdinstructions. This drops a large dependency subtree, so the later security bumps in this stack touch fewer packages.About 1.6k lines of
yarn.lockare removed.Needs a decision: this is a tooling change, not just a version bump. After this lands, releases must be cut without release-it.
Stack
Part of the SCF-2415 audit work, split from
gaurav/chore/SCF-2415-audit-critical-highfor easier review. This is part 2 of 9. Stacked on Part 1: its base isgaurav/chore/SCF-2415-part-1-drop-node-16, so the diff only shows this part. Merge in order.Review notes
Confirm that removing release-it is acceptable for how this fork is released. The lockfile change is a pure prune.
Testing
yarn install --frozen-lockfilepasses on this branch. The full suite (yarn lint,ember test) was run on the top of the stack (Part 9): 0 lint errors, 526 passed, 10 skipped, 0 failed.🤖 Generated with Claude Code